Skip to content

[MEDIUM] Bump @xmldom/xmldom to 0.8.15 - #58343

Open
OskarEichler wants to merge 1 commit into
react:mainfrom
OskarEichler:codex/security-xmldom
Open

OskarEichler wants to merge 1 commit into
react:mainfrom
OskarEichler:codex/security-xmldom

Conversation

@OskarEichler

@OskarEichler OskarEichler commented Sep 4, 2026 •

Copy link
Copy Markdown
Contributor

Summary

  • raise the existing @xmldom/xmldom resolution floor from 0.8.13 to 0.8.15
  • lock the Electron packager dependency to the fixed 0.8.15 release
  • remain within the existing 0.8.x line

Security impact

Versions through 0.8.14 are affected by GHSA-6gmq-8vp8-gcm6, which permits XML fragment injection when an invalid EntityReference node name is serialized with well-formed output enabled.

Test Plan

  • yarn install --frozen-lockfile --ignore-scripts
  • yarn why @xmldom/xmldom confirmed 0.8.15
  • yarn audit no longer reports the xmldom advisory
  • yarn build
  • debugger-shell: 4 suites, 9 tests, 4 snapshots passed
  • XML parse/serialize compatibility check
  • Jest retained a pre-existing open handle after reporting success and was stopped after completion
  • git diff --check

Changelog:

[INTERNAL] [SECURITY] - Bump @xmldom/xmldom to 0.8.15.

@meta-cla meta-cla Bot added the CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. label Sep 4, 2026
@facebook-github-tools facebook-github-tools Bot added the Shared with Meta Applied via automation to indicate that an Issue or Pull Request has been shared with the team. label Sep 4, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. Shared with Meta Applied via automation to indicate that an Issue or Pull Request has been shared with the team.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant